Earlier this month, a Microsoft-led action resulted in the Rustock botnet …

Share this story

It's sure to be temporary, but we should enjoy it while we can: Microsoft's action to behead the Rustock botnet has seen global spam levels drop by about a third, according to Symantec-owned messaging and security provider MessageLabs.

The full report shows that there's still a lot of work to be done. In 2010, 88 percent of all spam emails were sent by botnets, and of that botnet-originated spam, Rustock was responsible for an average of 28 percent. Taking out Rustock has unsurprisingly had a substantial impact on spam levels. However, MessageLabs reports that other botnets have increased spam production over the same period, making it likely that previous spam volumes will be resumed soon enough.

The data does give some reason for optimism, however. Just ten botnets (including Rustock) are responsible for about 74 percent of all spam. Taking out these botnets would not be a minor undertaking, but it's still a manageable scale—the botnet market is relatively consolidated. While eradicating the botnets certainly won't eradicate spam, it may well reduce it to tolerable levels. Gradual improvements in system security—not least the slow abandonment of Windows XP—and replacement of infected systems should make it harder to recruit large-scale botnets in the future, amplifying the effect of each botnet takedown.

That future is, alas, still some way off; in the meantime, aggressive spam filtering at the server and client level is the only viable recourse. A case might also be made for better legislation—one of the more surprising aspects of Microsoft's Rustock lawsuit was the circuitous route by which the company had the server hardware used by the botnet seized. The company had to use trademark law—claiming that Rustock's spam infringed on both its own and Pfizer's trademarks—in order to have the server hardware seized. Existing anti-spam legislation only allows domain names to be taken—an insufficient tool for taking down Rustock.